By Ann Marie van den Hurk, Mind The Gap Advisory
There is one person who knows the truth about your governance problem.
It is not your CISO. It is not your General Counsel. It is not your Chief Risk Officer.
It is your spouse. Your partner. Your family.
Would they say you can take a real vacation? Not a working vacation. Not the kind where you are physically present but mentally elsewhere, phone face-up on the dinner table, stepping away to take calls, checking email before anyone else wakes up.
A real vacation. Fully present. Unreachable by choice.
Most executives do not need time to think about it. The answer is immediate. And the look that crosses their face tells you everything.
This is not a work-life balance conversation
Here is the reframe that matters.
If you cannot take a real vacation — if your physical absence creates genuine operational risk — your organization has a structural problem that has been dressed up as a personal one.
The phone rings not because you have not learned to ignore it. The phone rings because the governance structure that should allow your team to operate without you has not been built.
You are the continuity plan. And that is a governance failure.
Every risk framework, every business continuity plan, every incident response document your organization has produced identifies single points of failure as critical vulnerabilities.
You would never architect a system where one unavailable component brings everything to a halt. But that is exactly what you have built around yourself.
Awareness is not the same as authority
There is a new pattern emerging in crisis response that makes this more urgent.
Organizations are detecting problems faster than ever. AI tools surface risk in minutes. Sentiment shifts get flagged in real time. The awareness is there almost immediately.
And then nothing happens for hours.
S&A Communications identified the gap plainly in their 2026 crisis leadership analysis. AI can surface risk. It cannot resolve disagreement. It cannot determine tone. It cannot align leadership. It cannot decide what should be said and when.
Awareness is not the same as authority. And authority is not the same as a person who is available, clear on their mandate, and able to make the call without waiting for someone above them to confirm it is theirs to make.
That is a human problem. Specifically, it is a governance problem.
And it connects directly to the most personal question in executive crisis readiness. If you are the person who holds that authority — if the organization moves when you say go and waits when you are not reachable — what happens when you are the one who is unavailable?
What happens when the crisis happens to you
When you are the one who is sick. When you are the one on a plane. When you are the one who is, for whatever reason, unreachable at exactly the moment you are needed most.
That is not a hypothetical. That is a scenario that happens. And when it does, the organization that looked resilient from the outside reveals itself to be dependent in the way that matters most.
If you are the continuity plan — if the organization holds together because you are always available — your incident response plan has a single point of failure. That failure will surface in an assessment or in an actual incident. One of those is recoverable.
What designed authority looks like instead
The fix is not learning to ignore the phone. The fix is building the governance structure that means the phone does not need to ring.
Designed authority is explicit. It names who decides. Under what conditions. Without having to ask. It does not depend on any individual being available, willing, or reachable. It is documented, tested, and understood by the people who need to use it before the pressure arrives.
The organizations that navigate AI and cyber crises with their operations and reputations intact are not the ones with the most capable individual leaders. They are the ones whose authority structure does not depend on any one person being available.
Your family already knows this. They have been living with the evidence of it for years. The question is whether you are ready to treat it as the governance problem it actually is.
If your physical absence creates operational risk
Governance Gap Map
A 90-minute structured session that surfaces where governance drift has created decision authority gaps — and what that exposure looks like before a mandate, deadline, or incident forces it into view. Written finding delivered within 48 hours.
Ann Marie van den Hurk, MSc., APR is the founder of Mind The Gap Advisory and originator of the CrisisOS5™ Framework. She advises CISOs, General Counsel, Chief Risk Officers, and boards on decision authority and executive crisis readiness for the AI era. Based in Newport, Rhode Island — serving organizations across New England, nationally, and globally. mindthegapcyber.com